@dyrected/core 2.19.0 → 2.20.1

package/dist/index.js

@@ -3011,6 +3011,14 @@ async function executeFieldAfterRead(fields, doc, user, db) {
 
 // src/trash.ts
 var TRASH_COLLECTION = "__trash";
+var INTERNAL_SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
+  "__audit",
+  "__sessions",
+  "__task_locks",
+  "__trash",
+  "__workflow_history",
+  "__lifecycle_events"
+]);
 var TRASH_COLLECTION_CONFIG = {
   slug: TRASH_COLLECTION,
   labels: { singular: "Trash entry", plural: "Trash entries" },
@@ -3102,7 +3110,7 @@ function assertValidTrashInConfig(config, source = "config") {
     if (col.slug === "trash") {
       throw new Error(`Collection slug "trash" is reserved by Dyrected for the trash system.`);
     }
-    const isSystem = col.slug.startsWith("__");
+    const isSystem = INTERNAL_SYSTEM_COLLECTIONS.has(col.slug);
     if (isSystem && col.trash) {
       throw new Error(`System collection "${col.slug}" cannot enable trash.`);
     }
@@ -3481,7 +3489,7 @@ function createTaskRunner(config) {
       throw error;
     }
   }
-  async function execute(task, row, scheduledFor) {
+  async function execute(task, row2, scheduledFor) {
     const started = Date.now();
     const lockMs = (task.lockTimeout ?? DEFAULT_LOCK_TIMEOUT_SECONDS) * 1e3;
     const token = `${instanceId}:${started}`;
@@ -3489,7 +3497,7 @@ function createTaskRunner(config) {
       id: { equals: task.name },
       lockedUntil: { less_than: started }
     };
-    if (scheduledFor) where.lastScheduledFor = { equals: row.lastScheduledFor };
+    if (scheduledFor) where.lastScheduledFor = { equals: row2.lastScheduledFor };
     const claimed = await db.update({
       collection: TASK_LOCKS_COLLECTION,
       where,
@@ -3550,21 +3558,21 @@ function createTaskRunner(config) {
     async runTask(name) {
       const task = tasks.get(name);
       if (!task) throw new Error(`Unknown task "${name}".`);
-      const row = await ensureLockRow(name, /* @__PURE__ */ new Date());
-      return track(execute(task, row, void 0));
+      const row2 = await ensureLockRow(name, /* @__PURE__ */ new Date());
+      return track(execute(task, row2, void 0));
     },
     async runDue(now2 = /* @__PURE__ */ new Date()) {
       const results = [];
       for (const task of tasks.values()) {
         if (!task.schedule) continue;
-        const row = await ensureLockRow(task.name, now2);
-        const reference = new Date(String(row.lastScheduledFor));
+        const row2 = await ensureLockRow(task.name, now2);
+        const reference = new Date(String(row2.lastScheduledFor));
         const due = Number.isNaN(reference.getTime()) ? true : nextCronRun(task.schedule, reference).getTime() <= now2.getTime();
         if (!due) {
           results.push({ name: task.name, status: "skipped", reason: "not-due", durationMs: 0 });
           continue;
         }
-        results.push(await track(execute(task, row, floorToMinute(now2))));
+        results.push(await track(execute(task, row2, floorToMinute(now2))));
       }
       return results;
     },
@@ -4079,13 +4087,34 @@ function getAdminRoleForCollection(collection) {
   }
   return "admin";
 }
+var STANDARD_ADMIN_ROLES = /* @__PURE__ */ new Set([
+  "admin",
+  "super_admin",
+  "superadmin",
+  "super admin",
+  "super-admin",
+  "owner"
+]);
 function isUserAdmin(user, collection) {
   if (!user) return false;
-  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
-  if (roles.length === 0) return false;
+  const rawRoles = Array.isArray(user.roles) ? user.roles : typeof user.roles === "string" ? [user.roles] : Array.isArray(user.role) ? user.role : typeof user.role === "string" ? [user.role] : [];
+  if (rawRoles.length === 0) return false;
+  const roles = rawRoles.filter((r) => typeof r === "string");
   const configuredRole = getAdminRoleForCollection(collection);
-  if (roles.includes(configuredRole)) return true;
-  return roles.includes("admin") || roles.includes("super_admin");
+  for (const r of roles) {
+    if (r === configuredRole || r.toLowerCase() === configuredRole.toLowerCase()) {
+      return true;
+    }
+    const normalized = r.trim().toLowerCase();
+    if (STANDARD_ADMIN_ROLES.has(normalized)) {
+      return true;
+    }
+    const stripped = normalized.replace(/[\s_-]+/g, "");
+    if (stripped === "admin" || stripped === "superadmin" || stripped === "owner") {
+      return true;
+    }
+  }
+  return false;
 }
 
 // src/utils/block-references.ts
@@ -4308,6 +4337,245 @@ function generateDocumentId(collectionOrSlug) {
   return generateId({ prefix, type });
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    codeBorder: "#e2e5dc",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(
+    /[&<>'"]/g,
+    (character) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      "'": "&#39;",
+      '"': "&quot;"
+    })[character]
+  );
+}
+function safeHttpUrl(value) {
+  if (value.startsWith("{{") && value.endsWith("}}")) {
+    return value;
+  }
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px", size = "15px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:${size};line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`
+    ),
+    `width:100%;background:${emailTokens.colors.code};border:1px solid ${emailTokens.colors.codeBorder};border-radius:${emailTokens.radius.control}`
+  );
+}
+function eventList(events) {
+  return table(
+    events.map(
+      ({ label, value }) => row(
+        `${sectionLabel(label)}${paragraph(value, "0")}`,
+        `padding:12px 0;border-bottom:1px solid ${emailTokens.colors.border}`
+      )
+    ).join("")
+  );
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(
+    row(
+      `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+      "padding:8px 0 24px"
+    ),
+    "width:auto"
+  );
+}
+function safeLinkDetailBox(href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return detailBox(safeHref, true);
+}
+function alertBox(content) {
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`
+    ),
+    `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`
+  );
+}
+function resolveBlocks(input) {
+  if (Array.isArray(input)) {
+    const parts = [];
+    for (const item of input) {
+      if (Array.isArray(item)) {
+        for (const sub of item) {
+          if (typeof sub === "string" && sub.length > 0) parts.push(sub);
+        }
+      } else if (typeof item === "string" && item.length > 0) {
+        parts.push(item);
+      }
+    }
+    return parts.join("\n");
+  }
+  return typeof input === "string" ? input : "";
+}
+function layout({ preheader, title, content, footer, siteName }) {
+  const resolvedContent = resolveBlocks(content);
+  const resolvedFooter = resolveBlocks(footer);
+  return `<!doctype html>
+<html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="x-apple-disable-message-reformatting">
+    <meta name="format-detection" content="telephone=no,address=no,email=no,date=no,url=no">
+    <meta name="color-scheme" content="light">
+    <meta name="supported-color-schemes" content="light">
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="margin:0;padding:0;background-color:${emailTokens.colors.canvas};word-spacing:normal;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+    <div style="display:none;max-height:0;max-width:0;overflow:hidden;opacity:0;mso-hide:all;color:transparent;font-size:1px;line-height:1px">
+      ${escapeHtml(preheader)}&#8203;&#847;&zwnj;&nbsp;&#8199;&#8199;&#847;&zwnj;&nbsp;
+    </div>
+    <center lang="en" style="width:100%;background-color:${emailTokens.colors.canvas}">
+      ${table(
+    row(
+      table(
+        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel(siteName ?? "Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(resolvedContent, "padding:0 32px 32px") + row(
+          `${divider()}${paragraph(resolvedFooter, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "10px 0px 0px 0px", "12px")}`,
+          "padding:0 32px 28px"
+        ),
+        `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+      ),
+      "padding:32px 12px"
+    ),
+    `width:100%;background:${emailTokens.colors.canvas}`
+  )}
+    </center>
+  </body>
+</html>`;
+}
+function getDefaultEmailTemplate(purpose, options) {
+  const siteName = options?.siteName ?? "Dyrected";
+  switch (purpose) {
+    case "invite":
+      return {
+        subject: `You've been invited to ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `You've been invited to join ${siteName}.`,
+          title: "You've been invited",
+          content: [
+            paragraph("Use the invitation link below to create your account. The link expires in 7 days."),
+            ctaButton("Accept invitation", "{{url}}"),
+            sectionLabel("Invitation link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you weren't expecting this invitation, you can safely ignore this email."
+        })
+      };
+    case "resetPassword":
+      return {
+        subject: "Reset your password",
+        rawHtml: layout({
+          siteName,
+          preheader: `Reset your ${siteName} password.`,
+          title: "Reset your password",
+          content: [
+            paragraph("We received a request to reset your password. The reset link expires in 1 hour."),
+            ctaButton("Reset password", "{{url}}"),
+            sectionLabel("Reset link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you didn't request a password reset, you can safely ignore this email."
+        })
+      };
+    case "welcome":
+      return {
+        subject: `Welcome to ${siteName} \u2014 your account is ready`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} account is ready.`,
+          title: "Welcome \u2014 your account is ready",
+          content: [paragraph("Your account has been created. You can now log in with:"), detailBox("{{email}}")],
+          footer: "If you didn't create this account, you can safely ignore this email."
+        })
+      };
+    case "passwordChanged":
+      return {
+        subject: "Your password has been changed",
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} password was changed.`,
+          title: "Password changed",
+          content: [
+            paragraph("The password for your account has been changed."),
+            alertBox("If you did not make this change, please contact support or reset your password immediately.")
+          ],
+          footer: "Security notice: this confirms a recent credential change."
+        })
+      };
+    default:
+      return {
+        subject: `Notification from ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Account notification from ${siteName}.`,
+          title: "Account Notification",
+          content: [paragraph(`This is an account notification from ${siteName}.`)],
+          footer: "If you have any questions, please reach out to our team."
+        })
+      };
+  }
+}
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -4449,6 +4717,114 @@ var AUTH_SESSIONS_COLLECTION_CONFIG = {
   },
   admin: { hidden: true }
 };
+var EMAIL_TEMPLATES_COLLECTION_SLUG = "__email_templates";
+var EMAIL_TEMPLATES_COLLECTION_CONFIG = {
+  slug: EMAIL_TEMPLATES_COLLECTION_SLUG,
+  labels: { singular: "Email Template", plural: "Email Templates" },
+  detail: false,
+  fields: [
+    {
+      name: "collectionSlug",
+      type: "select",
+      label: "Applies To",
+      required: true,
+      defaultValue: "*",
+      options: [
+        { label: "Global (All Users & Collections)", value: "*" }
+      ],
+      admin: {
+        description: "Choose which user collection this template applies to, or 'Global' for all users."
+      }
+    },
+    {
+      name: "purpose",
+      type: "select",
+      label: "Purpose",
+      required: true,
+      options: [
+        { label: "Invite", value: "invite" },
+        { label: "Password Reset", value: "resetPassword" },
+        { label: "Welcome", value: "welcome" },
+        { label: "Password Changed", value: "passwordChanged" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "format",
+      type: "select",
+      label: "Format",
+      required: true,
+      defaultValue: "html",
+      options: [
+        { label: "HTML", value: "html" },
+        { label: "External Template", value: "external_template" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "subject",
+      type: "text",
+      label: "Subject",
+      admin: {
+        description: "Subject line (optional when using external provider template)"
+      }
+    },
+    {
+      name: "rawHtml",
+      type: "textarea",
+      label: "HTML Content",
+      admin: {
+        description: "Raw HTML email content with {{variable}} tags"
+      }
+    },
+    {
+      name: "externalTemplateId",
+      type: "text",
+      label: "External Template ID",
+      admin: {
+        description: "Template ID or alias from Seamailer, Postmark, SendGrid, etc."
+      }
+    },
+    {
+      name: "active",
+      type: "boolean",
+      label: "Active",
+      defaultValue: true,
+      admin: {
+        description: "When active, this template overrides code config. When disabled, falls back to code."
+      }
+    }
+  ],
+  admin: {
+    group: "Settings",
+    icon: "Mail",
+    groupBy: "collectionSlug",
+    defaultColumns: ["purpose", "collectionSlug", "format", "active"]
+  },
+  hooks: {
+    beforeChange: [
+      async ({ data, req }) => {
+        if (data && data.format === "html") {
+          const siteName = req?.config?.admin?.branding?.logoText || "Dyrected";
+          const defaults = getDefaultEmailTemplate(data.purpose || "invite", { siteName });
+          if (!data.subject) {
+            data.subject = defaults.subject;
+          }
+          if (!data.rawHtml) {
+            data.rawHtml = defaults.rawHtml;
+          }
+        }
+        return data;
+      }
+    ]
+  },
+  access: {
+    read: ({ user }) => isUserAdmin(user),
+    create: ({ user }) => isUserAdmin(user),
+    update: ({ user }) => isUserAdmin(user),
+    delete: ({ user }) => isUserAdmin(user)
+  }
+};
 function normalizeConfig(config) {
   const schemaAwareConfig = normalizeSchemaFragment(config);
   assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
@@ -4463,10 +4839,13 @@ function normalizeConfig(config) {
   const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
   const needsTrash = schemaAwareConfig.trash?.enabled === true || collections.some((col) => resolveTrashConfig(col, schemaAwareConfig).enabled);
-  const adminAuthCollectionSlug = getAdminAuthCollection({
+  const adminAuthCollection = getAdminAuthCollection({
     collections,
     adminAuth: schemaAwareConfig.adminAuth
-  })?.slug;
+  });
+  const adminAuthCollectionSlug = adminAuthCollection?.slug;
+  const adminOnly = ({ user }) => isUserAdmin(user, adminAuthCollection);
+  const adminOtherThanSelf = ({ user, id }) => isUserAdmin(user, adminAuthCollection) && user?.id !== id;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -4515,7 +4894,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
+              update: adminOnly
             }
           }
         ];
@@ -4533,7 +4912,7 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             },
             admin: {
               condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
@@ -4602,7 +4981,7 @@ function normalizeConfig(config) {
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -4611,7 +4990,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -4703,6 +5082,52 @@ function normalizeConfig(config) {
   if (needsTrash && !normalizedCollections.some((col) => col.slug === TRASH_COLLECTION)) {
     systemCollections.push(TRASH_COLLECTION_CONFIG);
   }
+  const needsEmailTemplates = schemaAwareConfig.email?.adminEditable === true;
+  if (needsEmailTemplates && !normalizedCollections.some((col) => col.slug === EMAIL_TEMPLATES_COLLECTION_SLUG)) {
+    const adminCol = getAdminAuthCollection(schemaAwareConfig);
+    const customAccess = schemaAwareConfig.email?.access;
+    const resolveOpAccess = (op) => {
+      if (typeof customAccess === "function") return customAccess;
+      if (customAccess && typeof customAccess === "object" && customAccess[op]) return customAccess[op];
+      return ({ user }) => isUserAdmin(user, adminCol);
+    };
+    const customPurposes = schemaAwareConfig.email?.purposes ?? [];
+    const purposeOptions = [
+      { label: "Invite", value: "invite" },
+      { label: "Password Reset", value: "resetPassword" },
+      { label: "Welcome", value: "welcome" },
+      { label: "Password Changed", value: "passwordChanged" },
+      ...customPurposes
+    ];
+    const targetableCollections = normalizedCollections.filter(
+      (c) => !c.slug.startsWith("__")
+    );
+    const audienceOptions = [
+      { label: "Global (All Collections)", value: "*" },
+      ...targetableCollections.map((c) => ({
+        label: `${c.labels?.singular || c.labels?.plural || c.slug} (${c.slug})`,
+        value: c.slug
+      }))
+    ];
+    systemCollections.push({
+      ...EMAIL_TEMPLATES_COLLECTION_CONFIG,
+      fields: EMAIL_TEMPLATES_COLLECTION_CONFIG.fields.map((f) => {
+        if (f.name === "collectionSlug") {
+          return { ...f, options: audienceOptions };
+        }
+        if (f.name === "purpose") {
+          return { ...f, options: purposeOptions };
+        }
+        return f;
+      }),
+      access: {
+        read: resolveOpAccess("read"),
+        create: resolveOpAccess("create"),
+        update: resolveOpAccess("update"),
+        delete: resolveOpAccess("delete")
+      }
+    });
+  }
   return {
     ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
@@ -4822,6 +5247,10 @@ function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = pl
         }
         return `${c} = ${next()}`;
       case "not_equals":
+      case "not":
+      case "ne":
+      case "not_equal":
+      case "notEquals":
         if (operand === null) {
           return `${c} IS NOT NULL`;
         }
@@ -4837,9 +5266,33 @@ function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = pl
           } else {
             params.push(operand);
           }
-        } else {
-          params.push(operand);
+          return `${c} != ${next()}`;
+        }
+        if (Array.isArray(operand)) {
+          if (operand.length === 0) return "1=1";
+          const placeholders = operand.map((v) => {
+            if (typeof v === "boolean") {
+              if (placeholder === "?") {
+                params.push(v ? 1 : 0);
+              } else if (isJsonExtract) {
+                params.push(String(v));
+              } else {
+                params.push(v);
+              }
+            } else {
+              params.push(v);
+            }
+            return next();
+          });
+          return `${c} NOT IN (${placeholders.join(", ")})`;
         }
+        if (typeof operand === "object") {
+          const innerEntries = Object.entries(operand);
+          if (innerEntries.length === 0) return "1=1";
+          const innerSql = innerEntries.map(([innerOp, innerOperand]) => buildSingleOp(c, innerOp, innerOperand)).join(" AND ");
+          return `NOT (${innerSql})`;
+        }
+        params.push(operand);
         return `${c} != ${next()}`;
       case "in": {
         const vals = Array.isArray(operand) ? operand : [operand];
@@ -4910,6 +5363,15 @@ function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = pl
       } else if (upperField === "AND" && Array.isArray(value)) {
         const sub = value.map((v) => `(${buildClause(v)})`).join(" AND ");
         parts.push(`(${sub})`);
+      } else if (upperField === "NOT") {
+        if (Array.isArray(value)) {
+          const sub = value.map((v) => `(${buildClause(v)})`).join(" AND ");
+          parts.push(`(NOT (${sub}))`);
+        } else if (typeof value === "object" && value !== null && !("equals" in value || "not_equals" in value || "not" in value || "ne" in value || "not_equal" in value || "notEquals" in value || "in" in value || "not_in" in value || "gt" in value || "gte" in value || "lt" in value || "lte" in value || "contains" in value || "like" in value || "starts_with" in value || "exists" in value)) {
+          parts.push(`(NOT (${buildClause(value)}))`);
+        } else {
+          parts.push(buildOperator(field, value));
+        }
       } else {
         parts.push(buildOperator(field, value));
       }
@@ -4940,7 +5402,28 @@ function parseMongoWhere(where) {
       case "equals":
         return { [field]: { $eq: operand } };
       case "not_equals":
+      case "not":
+      case "ne":
+      case "not_equal":
+      case "notEquals": {
+        if (Array.isArray(operand)) {
+          return { [field]: { $nin: operand } };
+        }
+        if (typeof operand === "object" && operand !== null) {
+          const innerEntries = Object.entries(operand);
+          if (innerEntries.length === 1) {
+            const [innerOp, innerOperand] = innerEntries[0];
+            const inner = buildSingleOp(field, innerOp, innerOperand)[field];
+            return { [field]: { $not: inner } };
+          }
+          const merged = {};
+          for (const [innerOp, innerOperand] of innerEntries) {
+            Object.assign(merged, buildSingleOp(field, innerOp, innerOperand)[field]);
+          }
+          return { [field]: { $not: merged } };
+        }
         return { [field]: { $ne: operand } };
+      }
       case "in":
         return { [field]: { $in: Array.isArray(operand) ? operand : [operand] } };
       case "not_in":
@@ -4978,6 +5461,14 @@ function parseMongoWhere(where) {
         conditions.push({ $or: value.map(buildClause) });
       } else if (upperField === "AND" && Array.isArray(value)) {
         conditions.push({ $and: value.map(buildClause) });
+      } else if (upperField === "NOT") {
+        if (Array.isArray(value)) {
+          conditions.push({ $nor: value.map(buildClause) });
+        } else if (typeof value === "object" && value !== null && !("equals" in value || "not_equals" in value || "not" in value || "ne" in value || "not_equal" in value || "notEquals" in value || "in" in value || "not_in" in value || "gt" in value || "gte" in value || "lt" in value || "lte" in value || "contains" in value || "like" in value || "starts_with" in value || "exists" in value)) {
+          conditions.push({ $nor: [buildClause(value)] });
+        } else {
+          conditions.push(buildOperator(field, value));
+        }
       } else {
         conditions.push(buildOperator(field, value));
       }
@@ -4999,7 +5490,7 @@ function coerceBooleanWhere(where, fields) {
     if (!node || typeof node !== "object") return node;
     const out = {};
     for (const [key, value] of Object.entries(node)) {
-      if (key.toUpperCase() === "AND" || key.toUpperCase() === "OR") {
+      if (key.toUpperCase() === "AND" || key.toUpperCase() === "OR" || key.toUpperCase() === "NOT") {
         out[key] = walk(value);
       } else if (booleanFields.has(key)) {
         if (value && typeof value === "object" && !Array.isArray(value)) {
@@ -6030,6 +6521,31 @@ function generateOpenApi(config) {
       spec.paths[`${path}/accept-invite`] = {
         post: publicAuthPost("Accept an invitation")
       };
+      spec.paths[`${path}/tokens/verify`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Verify an invite or password reset token`,
+          parameters: [
+            {
+              name: "token",
+              in: "query",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "purpose",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["invite", "reset"] }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Token verification result"
+            }
+          }
+        }
+      };
       spec.paths[`${path}/{id}/change-password`] = {
         post: {
           tags: [collectionTag],
@@ -7227,8 +7743,8 @@ function sanitizeDocForAI(options) {
 // src/utils/index-name.ts
 import { createHash } from "crypto";
 var MAX_INDEX_NAME_LENGTH = 60;
-function resolveIndexName(prefix, table, fields) {
-  const full = `${prefix}_${table}_${fields.join("_")}`;
+function resolveIndexName(prefix, table2, fields) {
+  const full = `${prefix}_${table2}_${fields.join("_")}`;
   if (full.length <= MAX_INDEX_NAME_LENGTH) return full;
   const hash = createHash("sha1").update(full).digest("hex").slice(0, 10);
   const tail = (fields[fields.length - 1] ?? "").slice(0, 30);
@@ -7700,7 +8216,7 @@ function compileNavigation(config) {
   const mentionedTrash = explicitNav.some((i) => i.trash || i.slug === "trash");
   if (!mentionedTrash) {
     const hasTrash = collections.some(
-      (col) => !col.slug.startsWith("__") && resolveTrashConfig(col, config).enabled
+      (col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && resolveTrashConfig(col, config).enabled
     );
     if (hasTrash) {
       registerItem(void 0, {
@@ -8030,8 +8546,11 @@ export {
   DuplicateKeyError,
   DyrectedAIError,
   DyrectedError,
+  EMAIL_TEMPLATES_COLLECTION_CONFIG,
+  EMAIL_TEMPLATES_COLLECTION_SLUG,
   FieldConditionBuilder,
   ForbiddenError,
+  INTERNAL_SYSTEM_COLLECTIONS,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   MatchBuilder,
@@ -8049,6 +8568,7 @@ export {
   WORKFLOW_HISTORY_COLLECTION,
   abs,
   addDays,
+  alertBox,
   asCollection,
   assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig,
@@ -8078,6 +8598,7 @@ export {
   createTaskRunner,
   createTrashPurgeTask,
   createWorkflowDocument,
+  ctaButton,
   defaultValue,
   defineAction,
   defineArrayField,
@@ -8124,6 +8645,7 @@ export {
   defineUrlField,
   defineView,
   defineWorkspace,
+  detailBox,
   diffDays,
   dispatchLifecycleEvent,
   dispatchPendingLifecycleEvents,
@@ -8139,10 +8661,14 @@ export {
   displayTab,
   displayTabs,
   displayText,
+  divider,
+  emailTokens,
   endsWith,
+  escapeHtml,
   evaluateDetailComputed,
   evaluateJexl,
   evaluateJexlSync,
+  eventList,
   executeFieldAfterRead,
   executeFieldBeforeChange,
   expr,
@@ -8159,8 +8685,10 @@ export {
   getAdminAuthCollection,
   getAdminRoleForCollection,
   getAllowedSitesForUser,
+  getDefaultEmailTemplate,
   getPublicAdminAuthConfig,
   getTrashEntryId,
+  heading,
   includes,
   initializeWorkflowDocument,
   isAICollection,
@@ -8173,6 +8701,7 @@ export {
   isUserAdmin,
   join,
   last,
+  layout,
   length,
   lower,
   maskEmail,
@@ -8188,6 +8717,7 @@ export {
   normalizeGroupKey,
   now,
   numericFieldNames,
+  paragraph,
   parseCron,
   parseMongoWhere,
   parseSort,
@@ -8204,21 +8734,27 @@ export {
   resolveAdminAuthCollection,
   resolveAllCollectionViews,
   resolveAuthorizedSiteId,
+  resolveBlocks,
   resolveDocumentTitle,
   resolveIndexName,
   resolvePrefix,
   resolveTrashConfig,
   restoreDocument,
   round,
+  row,
   runCollectionHooks,
+  safeLinkDetailBox,
   sanitizeDocForAI,
   saveWorkflowDraft,
+  sectionLabel,
   simplePublishingWorkflow,
   slugify,
   softDeleteDocument,
+  spacer,
   sqrt,
   startsWith,
   sum,
+  table,
   today,
   transitionWorkflow,
   trim,